Overview

overview

10

Static

static

3

sysbybt.exe

windows7-x64

10

sysbybt.exe

windows10-2004-x64

10

Resubmissions

23-10-2024 13:17

241023-qjq76asbla 10

23-10-2024 12:59

241023-p78lnstanq 10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    23-10-2024 12:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    sysbybt.exe

  • Size

    480KB

  • MD5

    3282f6c806a89359ec94f287cf6c699c

  • SHA1

    c21f0c289d247a5b8cf2526d09d2d443a1068704

  • SHA256

    64d187bed40d023e14d41b1a80d528f5c12dcf743fcb4de91530567d3244e09e

  • SHA512

    88b3edd6865e4bb5ca2ba931c39f33ce0bc1363a694426115c489d85ee043ae28842785aafe1147fcc79d5c1644295794fa38c5a399fb4b27bc85327898f0185

  • SSDEEP

    12288:8oNcRxBnd9Zf/Y0wZB64czrTRUIFUNCY+8HX:4Lnd9Zf/05cfyIFU/

Score
10/10
phorphiexdiscoveryevasionexecutionloaderpersistencetrojanworm

Malware Config

Extracted

Family

phorphiex

C2

http://b0t.to/

http://gshrghirhgsgrao.to/

http://hehfaofiehgggao.to/

http://soghrrsoeuhugao.to/

http://eiiiaoihoaeruao.to/

http://roiriorisioroao.to/

http://ouhgousgoahutao.to/

http://oeoaoueuoeuoaao.to/

http://aiaizzzezeezeao.to/

http://ouauooaoaoeeuao.to/

http://oeeoeuueueuueao.to/

http://eobbeaubfeuueao.to/

http://aauaaaeieiieeao.to/

http://aaaeieiiiofffao.to/

http://infineinfinigao.to/

http://baoefubfbfigoao.to/

http://aaauuwiifoogeao.to/

http://plporsiszsgetao.to/

http://gshrghirhgsgrla.co/

http://hehfaofiehgggla.co/
Wallets

1L6sJ7pmk6EGMUoTmpdbLez9dXACcirRHh

qzgdgnfd805z83wpu04rhld0yqs4dlrd35ll0ltqql

Xt8ZtCcG9BFoc7NfUNBVnxcTvYT4mmzh5i

D7otx94yAiXMUuuff23v8PAYH5XpkdQ89M

0xa5228127395263575a4b4f532e4f132b14599d24

LUMrZN6GTetcrXtzMmRayLpRN9JrCNcTe7

t1PVHo3JR9ZAxMxRXgTziGBeDwfb5Gwm64z
Attributes
  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
    evasiontrojan
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Phorphiex payload 2 IoCs
  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex
  • Windows security bypass 2 TTPs 12 IoCs
    evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Windows security modification 2 TTPs 14 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\sysbybt.exe
    "C:\Users\Admin\AppData\Local\Temp\sysbybt.exe"
    1⤵
    • Modifies Windows Defender Real-time Protection settings
    • Windows security bypass
    • Loads dropped DLL
    • Windows security modification
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2156
    • C:\Users\Admin\AppData\Local\Temp\17585.exe
      C:\Users\Admin\AppData\Local\Temp\17585.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3032
      • C:\Windows\sysblvrvcr.exe
        C:\Windows\sysblvrvcr.exe
        3⤵
        • Modifies security service
        • Windows security bypass
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2232
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1108
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1232
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1768
          • C:\Windows\SysWOW64\sc.exe
            sc stop UsoSvc
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:1240
          • C:\Windows\SysWOW64\sc.exe
            sc stop WaaSMedicSvc
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:832
          • C:\Windows\SysWOW64\sc.exe
            sc stop wuauserv
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:3052
          • C:\Windows\SysWOW64\sc.exe
            sc stop DoSvc
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:904
          • C:\Windows\SysWOW64\sc.exe
            sc stop BITS /wait
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:1520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

System Services

1
T1569

Service Execution

1
T1569.002

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

3
T1543

Windows Service

3
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

3
T1543

Windows Service

3
T1543.003

Defense Evasion

Impair Defenses

4
T1562

Disable or Modify Tools

3
T1562.001

Modify Registry

5
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1
T1489

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7CNUR30T\3[1]
    Filesize

    15KB

    MD5

    1568efb715bd9797610f55aa48dfb18e

    SHA1

    076c40d61a821cf3069508ee873f3d4780774cb3

    SHA256

    f42ef51c4c7c8f607a0405848593369bfc193b771e8ed687540632cad1376216

    SHA512

    03d4357a8a1faa9110fb023e4c504bcb284d6665848c2918a543c1928ffac78fdf573d201932517c23a22a6e50c3ddd9d9035bbf8e735ddae3bc0fea8949f7e8

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EOYL2MRI\2[1]
    Filesize

    8KB

    MD5

    39f45edb23427ebf63197ca138ddb282

    SHA1

    4be1b15912c08f73687c0e4c74af0979c17ff7d5

    SHA256

    77fbb0d8630024634880c37da59ce57d1b38c7e85bdcc14c697db9e79c24e0de

    SHA512

    410f6baad25b256daebfa5d8b8a495429c9e26e7de767b2a0e6e4a75e543b77dbd0abca0335fb1f0d91e49e292b42cedc6edd72d25a3c4c62330e2b31c054cc6

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EOYL2MRI\4[1]
    Filesize

    10KB

    MD5

    2266f0aecd351e1b4092e82b941211ea

    SHA1

    1dced8d943494aa2be39ca28c876f8f736c76ef1

    SHA256

    cbbad0ab02cd973c9c4e73336e3bcd0849aeb2232a7bdbc38f0b50696b5c28c3

    SHA512

    6691cd697bbe7f7a03d9de33869aab289d0a1438b4ee194d2047ded957a726b1d3fe93f08e4a0c677018b20e2521aeb021ab1dc4d1a67927604829ddfd9d59aa

    Download Submit

  • \Users\Admin\AppData\Local\Temp\17585.exe
    Filesize

    107KB

    MD5

    f437204b3e1627d8b03eefdf360281ad

    SHA1

    c824e787a9786d5fdd19effdec54abef217e5b39

    SHA256

    d4bbc125a9e94de44f4deea9d6b10adc87a1ec1aedd753b39d26bb15817fdadb

    SHA512

    bdb6fc7d1e7f61df6a7ff3036fd56793e1096937fb07fbe033692f20de1bc81ca0215c5eff5a21627607c1ca514296d9598490c244bba5ec60c74653e1978910

    Download Submit

  • memory/2156-0-0x0000000000400000-0x000000000047C000-memory.dmp

    Filesize

    496KB

    Download

  • memory/2156-1-0x0000000000458000-0x000000000045E000-memory.dmp

    Filesize

    24KB

    Download

  • memory/2156-2-0x0000000000458000-0x000000000045E000-memory.dmp

    Filesize

    24KB

    Download

  • memory/2156-19-0x00000000002E0000-0x00000000002EB000-memory.dmp

    Filesize

    44KB

    Download